Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 15, 2025

Bumps securego/gosec from 2.19.0 to 2.22.11.

Release notes

Sourced from securego/gosec's releases.

v2.22.11

Changelog

  • 424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f feature: add rule for trojan source (#1431)
  • aa2e2fb1bdc12e985c9c1b93a15200baf61350d1 feat(ai): add OpenAI and custom API provider support (#1424)
  • b6eea26df883bbf98351d68bf92fa247a232ac20 chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#1437)
  • 41f28e209a74be7102c923314ab604db2b1adb62 chore(deps): update module google.golang.org/genai to v1.37.0 (#1435)
  • daccba6b93d7303569d133a61ecb6dfa289603b6 refactor: simplify report functions in main.go (#1434)
  • d4be2876cf1b5bf9bcc659bc78d21ce01aea65fc Update go to 1.25.5 and 1.24.11 in CI (#1433)
  • fde75152394005b98542190c73b8eeea4c10db15 chore(deps): update all dependencies (#1425)
  • 20c9506c1996f71fd0e5a06fd4ecdf487699291a feat(ai): add support for latest Claude models and update provider flags (#1423)
  • bd9e372f2045f1c90321109bf57bc946ee07f47c Bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#1427)
  • 7aa7e938725d3afaeb210f0721e0d84070e052bd chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (#1428)
  • a58917f611bbd062000eac14a5c45434854f61f6 fix: correct schema with temporary placeholder (#1418)
  • 8b0d0b8871e094af2373cf78efecd795a001aaeb perf: skip SSA analysis if no analyzers are loaded (#1419)
  • 8a5d01aca5eb146cd9e04b7f077ef2246dcac037 test: add sarif validation (#1417)
  • a8fefd17f7f496edd6778796b5ad486d9772e3ff chore(deps): update all dependencies (#1421)
  • c34cbbf56507211a7bfd749654ba2e76c5851f71 Update go to version 1.25.4 and 1.24.10 in CI (#1415)
  • 10cf58a4a4a7db110cdb8f9a3e892a150239615a fix: build tag parsing. (#1413)
  • d2d734859ce213cb673795446ac96da4f0de8a17 chore(deps): update all dependencies (#1411)
  • afa853e9ebabe1410b9b86e3d397e0c138f22041 chore(deps): update all dependencies (#1409)
  • 6b2e6e45a67c8d5e995d849712cd8e895511e495 chore(deps): update all dependencies (#1408)
  • 0adab9d9bee15a7d79feeddb2998961c97dd9c19 Update gosec to version v2.22.10 in the github action (#1405)

v2.22.10

Changelog

  • 6be2b51fd78feca86af91f5186b7964d76cb1256 Update go to version 1.25.3 and 1.24.9 in CI (#1404)
  • fddb9427b874cb5177d0b52a31b293deeb83c1b4 chore(deps): update all dependencies (#1402)
  • f6760311e8a3db06e3d2d7e9817874dadcd34a25 Update go to version 1.25.2 and 2.24.8 in CI (#1401)
  • 35f7ec2ca2e35fb91f7684b376a58e0c61f6c2a3 chore(deps): update all dependencies (#1399)
  • 01029f0a74161c70f029d51b61592418038aa4b9 check nil slices, partially check bounds (#1396)
  • 34db3de0ee2c7ee2db87ce232132db29775ca50c Remove unused target from the makefile
  • f5a3b7ab78e0d83f3d73c30c6a029f74bf1825db Use the ginkgo command install by the dependencies
  • 761fcbc36cc182a6abd8b668000120c8b642203f Keep the go module at 1.24 version for compatibility reasons
  • 2238079261fdbec5c6d2eeabdd35506bd2e02707 Remove manual test deps
  • bb08aa3188034402763918bf82511b2c3b70e928 fix: text must be supplied when markdown is used
  • 23597d2569a26d726aa56a59460286afeddcc284 fix: improve error message of CheckAnalyzers
  • 8d7e9d598b887054bde0a84b08680d165bf90068 fix: log panic on SSA
  • 0d8255e75e4957f2469bf048a461484854419eab chore(deps): update all dependencies
  • f9c52aac4b897c84070cb8c8ef0c0d2d2180d532 Update gosec to version v.22.9 in the github action

v2.22.9

Changelog

  • 15d5c61e866bc2e2e8389376a31f1e5e09bde7d8 Update cosign to v2.6.0 and go in the CI to latest version
  • 7b8713e2c9114d7db686be71c260e4e9f7ffc2e9 fix(autofix): unnecessary conversion
  • 64ebfc010618034268272af465bb47dbbb49d64f feat(autofix): update gemini sdk and add anthropic claude
  • 506407e7dfe6979d514d362f0b2d2ea77f49f5c8 feat(G304): add os.Root remediation hint (Autofix) when Go >= 1.24
  • 3ead143f0a3b5ace623f1865ea0f560bf730cd32 chore(deps): update all dependencies
  • e81fba3c3afd54f0740d580297d9206d972d47b9 refactor(G304): remove unused trackJoin helper; no functional change
  • ab078db7b0e0de577588ae298d22d1b490bf136c style: gofmt rules/readfile.go
  • e6218c83ecf834512867fda709dbb096b9cc06aa test(g304): add samples for var perm and var flag with cleaned path\n\n- Ensure G304 does not fire when only non-path args (flag/perm) are variables\n- Both samples use filepath.Clean on the path arg\n- Rules suite remains green (42 passed)

... (truncated)

Commits
  • 424fc4c feature: add rule for trojan source (#1431)
  • aa2e2fb feat(ai): add OpenAI and custom API provider support (#1424)
  • b6eea26 chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#1437)
  • 41f28e2 chore(deps): update module google.golang.org/genai to v1.37.0 (#1435)
  • daccba6 refactor: simplify report functions in main.go (#1434)
  • d4be287 Update go to 1.25.5 and 1.24.11 in CI (#1433)
  • fde7515 chore(deps): update all dependencies (#1425)
  • 20c9506 feat(ai): add support for latest Claude models and update provider flags (#1423)
  • bd9e372 Bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#1427)
  • 7aa7e93 chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (#1428)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [securego/gosec](https://github.com/securego/gosec) from 2.19.0 to 2.22.11.
- [Release notes](https://github.com/securego/gosec/releases)
- [Commits](securego/gosec@v2.19.0...v2.22.11)

---
updated-dependencies:
- dependency-name: securego/gosec
  dependency-version: 2.22.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant